turva-llms-txt-validator 0.3.8 → 0.3.10

package/README.md

@@ -8,7 +8,7 @@ Check a website's `llms.txt` from the command line, Node or CI. Get a clear resu
 
 ## Quick start
 
-Requires **Node.js 18.17 or newer**. Run it without a global install:
+Requires **Node.js 22 or newer**. Run it without a global install:
 
 ```sh
 npx --yes turva-llms-txt-validator example.com
@@ -54,7 +54,7 @@ Use JSON for automation and strict mode when warnings should fail a CI step:
 npx --yes turva-llms-txt-validator example.com --json --strict
 ```
 
-Completed validation returns `{ target, summary, checks }`. Each check contains `{ id, status, label, detail }`. With `--json`, input and fetch errors return `{ "error": "..." }` and exit with code `2`. An unknown option, a second domain and a missing domain are input errors too, and `--help` exits with code `0`.
+Completed validation returns `{ target, summary, checks }`. Each check contains `{ id, status, label, detail }`. With `--json`, input and fetch errors return `{ "error": "...", "target": "..." }` and exit with code `2`. The target is the address given on the command line, with any user name, password and query value masked, and a network error adds `code`, such as `EAI_AGAIN`. An unknown option, a second domain and a missing domain are input errors too. `--help` exits with code `0`, and `--version` or `-V` prints the installed version and exits with code `0`.
 
 ## What it checks
 
@@ -110,7 +110,7 @@ for (const check of result.checks) {
 
 ## Use in CI
 
-Add this step to a GitHub Actions job that already has Node.js 18.17 or newer available. Replace `your-domain.com` with your domain:
+Add this step to a GitHub Actions job that already has Node.js 22 or newer available. Replace `your-domain.com` with your domain:
 
 ```yaml
 - name: Validate llms.txt

package/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,40 @@
+# Third-party notices
+
+This package's own license is MIT, in `LICENSE`. The named character reference
+table in `src/index.mjs` (`NAMED_REFERENCE_DATA`) is generated from data
+published by a third-party package and carries that package's own license
+below. This is a build-time data source, not an installed runtime dependency:
+the table is generated once and copied into `src/index.mjs`, so no reference
+to it appears in `package.json` or in the dependency tree an installer sees.
+
+## character-entities
+
+- Package: `character-entities`
+- Version used to generate the table: 2.0.2
+- URL: <https://github.com/wooorm/character-entities>
+- License: MIT
+
+```
+(The MIT License)
+
+Copyright (c) 2015 Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+```

package/bin/cli.mjs

@@ -4,15 +4,18 @@
 // or bad input. The two v2 discovery checks and the input-path note carry status
 // "info" and move no exit code, by design. Same checks and JSON shape as the hosted validator:
 // curl -H "Accept: application/json" "https://turva.dev/llms-txt-validator?url=example.com"
-import { validateHost, stripControls } from "../src/index.mjs";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { validateHost, stripControls, maskLocation } from "../src/index.mjs";
 
 const USAGE = [
   "usage: llms-txt-validate <domain-or-url> [--json] [--strict]",
-  "  --json    print the result as JSON (same shape as the hosted validator)",
-  "  --strict  exit 1 on warnings too, for CI gates",
-  "  --help    print this help"
+  "  --json     print the result as JSON (same shape as the hosted validator)",
+  "  --strict   exit 1 on warnings too, for CI gates",
+  "  --help     print this help",
+  "  --version  print the installed version and exit"
 ];
-const KNOWN = new Set(["--json", "--strict", "--help", "-h"]);
+const KNOWN = new Set(["--json", "--strict", "--help", "-h", "--version", "-V"]);
 
 // The arguments are read strictly since 0.3.8 (Tek-496). An unknown flag such as a misspelled
 // --strcit used to be ignored, so a CI step ran without the gate it asked for, and a second
@@ -36,6 +39,15 @@ if (flags.includes("--help") || flags.includes("-h")) {
   for (const line of USAGE) console.log(line);
   process.exit(0);
 }
+if (flags.includes("--version") || flags.includes("-V")) {
+  // Read package.json relative to this file, not the caller's cwd, so this works the same
+  // whether the CLI runs installed, linked or through npx (V-04, outside audit 2026-09-26).
+  // No network read: the version is the one actually installed, not the npm registry's latest.
+  const pkgUrl = new URL("../package.json", import.meta.url);
+  const pkg = JSON.parse(readFileSync(fileURLToPath(pkgUrl), "utf8"));
+  console.log(pkg.version);
+  process.exit(0);
+}
 const unknown = flags.find((f) => !KNOWN.has(f));
 if (unknown) fail("unknown option " + JSON.stringify(stripControls(unknown).slice(0, 40)));
 if (targets.length === 0 || targets[0].trim() === "") fail("no domain or URL given");
@@ -61,7 +73,19 @@ try {
   // The hosted validator answers every failure as JSON when JSON was asked for, so a CI
   // step that parses --json output gets {"error": ...} here too instead of an empty stdout
   // and a plain-text stderr (round 16 S3-3). The exit code is unchanged.
-  if (json) console.log(JSON.stringify({ error: message }, null, 2));
-  else console.error("error: " + message);
+  //
+  // target and code are added as separate fields (V-05, outside audit 2026-09-26): a bare
+  // {"error": message} left a CI step unable to tell which target failed or why without
+  // parsing free text. code reads a network error's cause first (undici wraps the real
+  // errno code, such as EAI_AGAIN or ECONNREFUSED, in err.cause.code) and falls back to
+  // err.code for an error that sets it directly; it is omitted, not null, when neither is set.
+  // target goes through maskLocation like every other address the tool prints, so a user name,
+  // a password or a query value typed into the command line is never echoed back.
+  const code = (err && err.cause && err.cause.code) || (err && err.code);
+  if (json) {
+    const report = { error: message, target: stripControls(maskLocation(targets[0])) };
+    if (code) report.code = stripControls(String(code));
+    console.log(JSON.stringify(report, null, 2));
+  } else console.error("error: " + message);
   process.exit(2);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "turva-llms-txt-validator",
-  "version": "0.3.8",
+  "version": "0.3.10",
   "description": "Validate a site's llms.txt structure: eight checks as pass/warn/fail plus two llms.txt v2 discovery checks that read pass or info and never move the summary, JSON output. Same checks as the hosted validator at turva.dev/llms-txt-validator.",
   "type": "module",
   "main": "./src/index.mjs",
@@ -12,13 +12,14 @@
     "src",
     "bin",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "THIRD-PARTY-NOTICES.md"
   ],
   "scripts": {
     "test": "node --test"
   },
   "engines": {
-    "node": ">=18.17"
+    "node": ">=22"
   },
   "keywords": [
     "llms.txt",

package/src/index.mjs

@@ -39,7 +39,13 @@ export function cut(s, n) {
 export function maskLocation(href, base) {
   let u = null;
   try { u = new URL(href, base); } catch { u = null; }
-  if (u) {
+  // An opaque URL (no authority, e.g. "u:name@host/") parses without throwing but has no
+  // host, so clearing u.username/u.password is a silent no-op: WHATWG has nowhere to put
+  // them and the credential-shaped text stays in the opaque path untouched. Route it through
+  // the string branch below instead, the same one an unparseable target already uses
+  // (outside review 2026-09-28: a bare "u:" scheme let the text after it through as the
+  // CLI JSON "target" field, unmasked).
+  if (u && u.host) {
     u.username = "";
     u.password = "";
     for (const key of Array.from(u.searchParams.keys())) u.searchParams.set(key, "***");
@@ -202,20 +208,25 @@ function isEscaped(s, i) {
   return n % 2 === 1;
 }
 
-// Inline code spans of one line, marked per character, so a link written inside backticks is
-// read as the code it is (outside audit 2026-09-26, Tek-496). A span opens with a run of
-// backticks and closes with the next run of the same length on the same line. An escaped first
-// backtick is literal and the rest of its run still opens, while a closing run is never escaped,
-// because a backslash inside a code span is literal. Runs are grouped by length and every group
-// is read with one forward pointer, so the scan stays linear on a line of unmatched runs.
-function codeSpanMask(line) {
-  const mask = new Uint8Array(line.length);
+// Inline code spans, marked per character across the whole document, so a link written inside
+// backticks is read as the code it is (outside audit 2026-09-26, Tek-496), including when the
+// span itself crosses a real line ending: a fenceless "`[a](b)\ncontinued`" used to be masked
+// only on its own line, so the second line escaped the mask and its bracket read as a real link
+// (outside review 2026-09-28). A span opens with a run of backticks and closes with the next run
+// of the same length anywhere in the text; a pair whose interior holds a blank line (two line
+// endings in a row) is not a code span in CommonMark, so it is left unmasked and its backticks
+// stay literal. An escaped first backtick is literal and the rest of its run still opens, while a
+// closing run is never escaped, because a backslash inside a code span is literal. Runs are
+// grouped by length and every group is read with one forward pointer, so the scan stays linear on
+// a document of unmatched runs.
+function codeSpanMask(text) {
+  const mask = new Uint8Array(text.length);
   const runs = [];
-  for (let i = 0; i < line.length; ) {
-    if (line[i] !== "`") { i++; continue; }
+  for (let i = 0; i < text.length; ) {
+    if (text[i] !== "`") { i++; continue; }
     let j = i;
-    while (j < line.length && line[j] === "`") j++;
-    runs.push({ at: i, len: j - i, escaped: isEscaped(line, i) });
+    while (j < text.length && text[j] === "`") j++;
+    runs.push({ at: i, len: j - i, escaped: isEscaped(text, i) });
     i = j;
   }
   const byLen = new Map();
@@ -231,29 +242,61 @@ function codeSpanMask(line) {
     ptr.set(len, p);
     if (p === list.length) continue;
     const close = runs[list[p]];
-    mask.fill(1, r.escaped ? r.at + 1 : r.at, close.at + close.len);
+    const start = r.escaped ? r.at + 1 : r.at;
+    const end = close.at + close.len;
+    if (text.slice(start, end).indexOf("\n\n") === -1) mask.fill(1, start, end);
     k = list[p];
   }
   return mask;
 }
 
+// A CommonMark link reference label is matched without regard to case or the exact run of
+// whitespace inside it, so "[Guide]" and "[ guide ]" name the same definition.
+function normalizeLinkLabel(s) {
+  return s.trim().replace(/\s+/g, " ").toLowerCase();
+}
+
+// Link reference definitions, "[label]: target", read once per document so a reference link
+// such as "[text][label]" can resolve against one written anywhere else in the same file,
+// before or after its use, the way CommonMark allows (outside review 2026-09-28). A title
+// after the target is not read, because nothing here compares it, and only the first
+// definition of a given label counts, per spec. A destination wrapped in angle brackets has
+// them stripped.
+function collectLinkDefinitions(text) {
+  const defs = new Map();
+  for (const line of text.split("\n")) {
+    const m = /^ {0,3}\[([^\]]+)\]:[ \t]*(<[^<>\n]*>|\S+)/.exec(line);
+    if (!m) continue;
+    const label = normalizeLinkLabel(m[1]);
+    if (!label || defs.has(label)) continue;
+    let dest = m[2];
+    if (dest[0] === "<" && dest[dest.length - 1] === ">") dest = dest.slice(1, -1);
+    defs.set(label, dest);
+  }
+  return defs;
+}
+
 // Every markdown link in the prose, scanned once from left to right. A "[" inside a code span,
 // an escaped "\[" and the "![" of an image open no link, because none of them is a hyperlink
 // (all three counted until the outside audit of 2026-09-26, Tek-496). A target may be written in angle
 // brackets and may carry a title in quotes, as CommonMark allows; both were missed or misread
-// before. The scan carries no bound and no backtracking: the furthest failed plain target is
-// remembered as before, and the closing ">", quote and line end are looked up through a cache
-// that only moves forward, so a file that repeats "[a](" or "[a](x \"" stays linear.
-function collectLinks(text) {
+// before. An image nested in the link text, such as "[a ![i](x)](y)", is link content and is
+// skipped whole rather than ending the scan, so the outer hyperlink is still found; any other
+// nested "[" still ends the scan the way it always has, because CommonMark does not allow a
+// link inside a link (outside review 2026-09-28: the previous scan gave up on the whole outer
+// link the moment any nested "[" appeared, image or not). A full or collapsed reference link,
+// "[text][label]" or "[text][]", resolves against collectLinkDefinitions; an unresolved label
+// is read as plain brackets, the way it always was. A resolved target is decoded for character
+// references ("&#58;", "&amp;", ...) the same way an HTML attribute value is, so a destination
+// written as "https://host&#58;99999/" is checked as what it resolves to and not as its literal
+// source spelling (outside review 2026-09-28). The scan carries no bound and no backtracking:
+// the furthest failed plain target is remembered as before, and the closing ">", quote and line
+// end are looked up through a cache that only moves forward, so a file that repeats "[a](" or
+// "[a](x \"" stays linear.
+function collectLinks(text, defs) {
   const out = [];
-  const code = new Uint8Array(text.length);
-  {
-    let at = 0;
-    for (const line of text.split("\n")) {
-      code.set(codeSpanMask(line), at);
-      at += line.length + 1;
-    }
-  }
+  const code = codeSpanMask(text);
+  if (!defs) defs = collectLinkDefinitions(text);
   const cache = Object.create(null);
   const nextIdx = (c, from) => {
     const h = cache[c];
@@ -304,17 +347,53 @@ function collectLinks(text) {
     if (!found) failEnd = e;
     return found;
   };
+  // An image nested in the link text is skipped whole: k is the index of its own "[", right
+  // after an unescaped "!". Its alt text is not itself scanned for nested links or images, the
+  // first unescaped "]" closes it, and it is only skipped when a target follows; a malformed
+  // image (no closing "]", no "(target)") is left for the caller to treat as an ordinary
+  // nested bracket, the way one always was.
+  const skipImage = (k) => {
+    let m = k + 1;
+    while (m < text.length && text[m] !== "]" && text[m] !== "[") m += text[m] === "\\" ? 2 : 1;
+    if (m >= text.length || text[m] !== "]" || text[m + 1] !== "(") return null;
+    const t = readTarget(m + 2);
+    return t ? t.end + 1 : null;
+  };
   for (let i = 0; i < text.length; i++) {
     if (text[i] !== "[" || code[i] || isEscaped(text, i)) continue;
     if (i > 0 && text[i - 1] === "!" && !isEscaped(text, i - 1)) continue;
     let j = i + 1;
-    while (j < text.length && text[j] !== "]" && text[j] !== "[") j += text[j] === "\\" ? 2 : 1;
+    for (;;) {
+      while (j < text.length && text[j] !== "]" && text[j] !== "[") j += text[j] === "\\" ? 2 : 1;
+      if (j >= text.length || text[j] !== "[") break;
+      if (code[j] || text[j - 1] !== "!" || isEscaped(text, j - 1)) break;
+      const after = skipImage(j);
+      if (after === null) break;
+      j = after;
+    }
     if (j >= text.length) break;
     if (text[j] === "[") { i = j - 1; continue; }
-    if (text[j + 1] !== "(") { i = j; continue; }
-    const t = readTarget(j + 2);
-    if (t) { out.push({ name: text.slice(i + 1, j), target: t.target }); i = t.end; continue; }
-    i = j + 1;
+    if (text[j + 1] === "(") {
+      const t = readTarget(j + 2);
+      if (t) { out.push({ name: text.slice(i + 1, j), target: decodeAttributeValue(t.target), at: i }); i = t.end; continue; }
+      i = j + 1;
+      continue;
+    }
+    if (text[j + 1] === "[") {
+      let m = j + 2;
+      while (m < text.length && text[m] !== "]" && text[m] !== "\n") m += text[m] === "\\" ? 2 : 1;
+      if (m < text.length && text[m] === "]") {
+        const rawLabel = text.slice(j + 2, m);
+        const label = normalizeLinkLabel(rawLabel === "" ? text.slice(i + 1, j) : rawLabel);
+        const dest = label && defs.get(label);
+        if (dest !== undefined) {
+          out.push({ name: text.slice(i + 1, j), target: decodeAttributeValue(dest), at: i });
+          i = m;
+          continue;
+        }
+      }
+    }
+    i = j;
   }
   return out;
 }
@@ -356,16 +435,12 @@ function fenceMask(lines) {
 }
 // A markdown list item that carries a link. A bullet or an ordered marker (1. or 1)) followed by
 // a space or a tab opens the item; an ordered list and a tab after the marker were not read as
-// list items until 2026-09-27 (Tek-496). The link is found by collectLinks, so code, escapes
-// and images count here exactly as they do in the links check. A bare CR, U+2028 and U+2029 stay
-// inside a line after split(/\r?\n/), and a link behind one has never counted, so the item is read
-// up to the first of them.
-function listItemHasLink(l) {
-  const m = /^ {0,3}(?:[-*+]|\d{1,9}[.)])[ \t]/.exec(l);
-  if (!m) return false;
-  const sep = l.slice(m[0].length).search(/[\r\u2028\u2029]/);
-  const body = sep === -1 ? l.slice(m[0].length) : l.slice(m[0].length, m[0].length + sep);
-  return collectLinks(body).length > 0;
+// list items until 2026-09-27 (Tek-496). Whether the line carries a link is decided by the
+// caller against the whole document's own collectLinks result (hasLink), not by re-scanning
+// this one line in isolation: a code span or a reference link target can resolve only across
+// more than one line, and a per-line rescan cannot see that (outside review 2026-09-28, V2).
+function listItemHasLink(l, hasLink) {
+  return !!hasLink && /^ {0,3}(?:[-*+]|\d{1,9}[.)])[ \t]/.test(l);
 }
 
 // The text of an ATX H1, or null when the line is not one. One to three leading spaces, a
@@ -423,8 +498,14 @@ export function validateLlmsTxt(f) {
   // v3.164.0): a query value or a fragment in a same-host Location used to reach this
   // detail as sent.
   add("http-status", "pass", "File exists at /llms.txt", f.redirectedFrom ? "HTTP 200, followed a redirect from " + maskLocation(f.redirectedFrom) + " to " + maskLocation(f.finalUrl) : "HTTP 200");
+  // A leading byte-order mark is stripped the same way the fetch path already strips it: the
+  // TextDecoder used there removes a BOM by default, so the direct API took a different
+  // document than the fetched one for the exact same bytes until this was measured (outside
+  // review 2026-09-28); the h1-title check saw the mark as part of the first line and failed a
+  // document that would pass when fetched.
+  const text = f.text.charCodeAt(0) === 0xFEFF ? f.text.slice(1) : f.text;
   const ct = (f.contentType || "").toLowerCase();
-  const looksHtml = /^\s*(<!doctype|<html|<head|<body)/i.test(f.text);
+  const looksHtml = /^\s*(<!doctype|<html|<head|<body)/i.test(text);
   if (looksHtml) {
     add("content-type", "fail", "Response is plain text", "the body looks like an HTML page, not an llms.txt file");
     return checks;
@@ -437,7 +518,7 @@ export function validateLlmsTxt(f) {
   } else {
     add("content-type", "warn", "Response is plain text", "content-type is " + (ct.split(";")[0] || "missing") + ", text/plain or text/markdown is the convention");
   }
-  const lines = f.text.split(/\r?\n/);
+  const lines = text.split(/\r?\n/);
   const firstIdx = lines.findIndex((l) => l.trim() !== "");
   const firstRaw = firstIdx === -1 ? "" : lines[firstIdx];
   const first = firstRaw.trim();
@@ -454,7 +535,16 @@ export function validateLlmsTxt(f) {
     add("h1-title", "fail", "Starts with an H1 title", "the first non-empty line should be a markdown H1 (# Site name)");
   }
   const afterH1 = lines.slice(firstIdx + 1).find((l) => l.trim() !== "") || "";
-  if (afterH1.trim().startsWith("> ")) {
+  // Read the same way as the H1 check and the "late" blockquote search below: at most three
+  // leading spaces, per CommonMark. A trim-first prefix test used to erase the difference, so
+  // a four-space or tab-indented code block right after the title passed as the summary until
+  // 2026-09-27 (Tek-496, mirrored from worker.js).
+  // A blockquote marker is 0-3 leading spaces plus ">", optionally followed by one space that
+  // is then part of the marker and not the content; CommonMark reads ">Summary" and a tab the
+  // same way, and four or more leading spaces stay indented code, not a blockquote (outside
+  // review 2026-09-28: a literal space was required, so a tab or no space at all warned as
+  // missing).
+  if (/^ {0,3}>/.test(afterH1)) {
     add("summary", "pass", "Blockquote summary after the title", JSON.stringify(cut(afterH1.trim(), 80)));
   } else {
     // A blockquote further down, before the first H2, is a summary in the wrong place and not a
@@ -466,7 +556,7 @@ export function validateLlmsTxt(f) {
     for (let i = firstIdx + 1; i < lines.length; i++) {
       if (fence[i]) continue;
       if (/^ {0,3}## /.test(lines[i])) break;
-      if (/^ {0,3}> /.test(lines[i])) { late = i; break; }
+      if (/^ {0,3}>/.test(lines[i])) { late = i; break; }
     }
     add("summary", "warn", "Blockquote summary after the title", late === -1
       ? "recommended by the format (> one-line summary), not required"
@@ -477,6 +567,29 @@ export function validateLlmsTxt(f) {
   // demanded column zero, so a correct file indented by one to three spaces was reported as
   // having no sections at all while its list under the same indentation counted fine.
   const fenced = fenceMask(lines);
+  // Computed once for both the section-list scan below and the links check further down, so a
+  // reference link definition written anywhere in the prose resolves the same way for each
+  // (outside review 2026-09-28, V2): "[text][label]" used to be recognized in the whole-document
+  // links check but not in the per-line section scan, which only ever saw one list item line.
+  const proseText = lines.filter((l, i) => !fenced[i]).join("\n");
+  const linkDefs = collectLinkDefinitions(proseText);
+  const proseLinks = collectLinks(proseText, linkDefs);
+  // Which original line each recognized link starts on, so the section scan below can ask "does
+  // this line carry a link" against the same whole-document result the links check itself uses,
+  // instead of re-finding links one isolated line at a time (outside review 2026-09-28, V2).
+  const linkedLineIdx = new Set();
+  {
+    const owners = [];
+    for (let i = 0; i < lines.length; i++) if (!fenced[i]) owners.push(i);
+    const starts = [];
+    let offset = 0;
+    for (const pl of proseText.split("\n")) { starts.push(offset); offset += pl.length + 1; }
+    for (const link of proseLinks) {
+      let idx = 0;
+      for (let k = 0; k < starts.length; k++) { if (starts[k] <= link.at) idx = k; else break; }
+      linkedLineIdx.add(owners[idx]);
+    }
+  }
   const h2Count = lines.filter((l, i) => !fenced[i] && /^ {0,3}## /.test(l)).length;
   // A section counts when it carries a file list. An H2 followed by a paragraph satisfied
   // this check until 2026-08-29, and the format puts each section's links in a list.
@@ -493,7 +606,7 @@ export function validateLlmsTxt(f) {
       const h1 = /^ {0,3}#(?:[ \t]|$)/.test(l);
       if (misplaced === -1 && i > firstIdx && (h1 || (!seenH2 && /^ {0,3}#{3,6}(?:[ \t]|$)/.test(l)))) misplaced = i;
       if (h1) { inSection = false; continue; }
-      if (inSection && !counted && listItemHasLink(l)) { sectionsWithList++; counted = true; }
+      if (inSection && !counted && listItemHasLink(l, linkedLineIdx.has(i))) { sectionsWithList++; counted = true; }
     }
   }
   if (h2Count > 0 && sectionsWithList > 0) {
@@ -509,8 +622,9 @@ export function validateLlmsTxt(f) {
     s.detail += "; the heading at line " + (misplaced + 1) + " is out of place, because the format has one H1 and no other heading before the first H2";
   }
   // Links are collected from the prose only, for the same reason the headings are: a link
-  // shown inside a code fence is an example of a link, not one an agent can follow.
-  const links = collectLinks(lines.filter((l, i) => !fenced[i]).join("\n"));
+  // shown inside a code fence is an example of a link, not one an agent can follow. Computed
+  // once above as proseLinks, reused here under its usual name.
+  const links = proseLinks;
   // An entry an agent can use has a name and a target with a host. An empty name and a
   // bare "https://" both counted as valid absolute links until 2026-08-29.
   const named = links.filter((m) => m.name.trim() !== "");
@@ -534,7 +648,7 @@ export function validateLlmsTxt(f) {
   } else {
     add("size", "warn", "Small enough to be cheap to read", f.bytes + " bytes; consider moving detail to llms-full.txt");
   }
-  if (/<[a-z][a-z0-9-]*[\s>]/i.test(f.text)) {
+  if (/<[a-z][a-z0-9-]*[\s>]/i.test(text)) {
     add("no-html", "warn", "No HTML markup in the file", "HTML tags found; llms.txt should be plain markdown");
   } else {
     add("no-html", "pass", "No HTML markup in the file", "plain markdown");
@@ -679,8 +793,11 @@ var C1_REPLACEMENTS = {
 
 // The full WHATWG list of named character references, 2 231 names: "name!hex" is a name that
 // also decodes without its ";", "name=hex" one that needs it, and several code points are
-// separated by ",". Generated 2026-09-12 from the character-entities package, with every value
-// and every legacy name checked against the decoder of the entities package.
+// separated by ",". Generated 2026-09-12 from character-entities 2.0.2
+// (https://github.com/wooorm/character-entities), (c) 2015 Titus Wormer, MIT, with every value
+// and every legacy name checked against the decoder of the entities package. The full license
+// text is in THIRD-PARTY-NOTICES.md (E01, outside audit 2026-09-26); this is a build-time data
+// source copied in at generation time, not an installed runtime dependency.
 var NAMED_REFERENCE_DATA =
   "AElig!c6 AMP!26 Aacute!c1 Abreve=102 Acirc!c2 Acy=410 Afr=1d504 Agrave!c0 Alpha=391 Amacr=100 " +
   "And=2a53 Aogon=104 Aopf=1d538 ApplyFunction=2061 Aring!c5 Ascr=1d49c Assign=2254 Atilde!c3 " +